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Abstract 



The study of alternative models for elliptic curves has found recent in- 
(■h , terest from cryptographic applications, after it was recognized that such 

models provide more efficiently computable algorithms for the group law 
than the standard Weierstrass model. Examples of such models arise via 
symmetries induced by a rational torsion structure. We analyze the mod- 
ule structure of the space of sections of the addition morphisms, determine 
explicit dimension formulas for the spaces of sections and their eigenspaces 
v ^ ■ under the action of torsion groups, and apply this to specific models of 

£f-\ ' elliptic curves with parametrized torsion subgroups. 

(N' 

en ■ 1 Introduction 

(~*) • Let k be a field and A an abelian variety over k with a given protectively normal 

embedding t : A — > P r , determined by an invertible sheaf Oa(1) '■— i*Ov(l) 
and denote the addition morphism on A by p, : A x A — > A. 

An addition law is an (r+l)-tuples = (po, ... ,p r ) of bihomogeneous elements 

k[A] <g) k[A] = k[X , . . . , X r ]/I A ® fc k[X , ..., X r ]/I A , 
where I a is the defining ideal of A, such that the rational map 

(x, y) = ((x : ■ ■ ■ : x r ), (y : • • • : y r )) i — > (p (x, y) : • • • : p r (x, y)) 

defines /i on the complement of Z = V(po, . . . ,p r ) in A x A. The set Z is 
called the exceptional set of s. Lange and Ruppcrt |16j give a characterization 
of addition laws, as sections of an invertible sheaf, from which it follows that the 
exceptional set of any nonzero addition law is the support of a divisor, which 
we refer to as the exceptional divisor. An addition law is said to have bidegree 
(m, n) if pj(x, y) are homogeneous of degree m and n in xt and yj, respectively. 
The addition laws of bidegree (m, n), including the zero element, form a A:- vector 
space. 



A set S of addition laws is said to be complete or geometrically complete if 
the intersection of the exceptional sets of all s in S is empty, and k-complete 
or arithmetically complete if this intersection contains no fc-rational point. We 
note that the term complete [TH [T7] has more recently been used to denote 
fc-complete, in literature with a view to computational and cryptographic ap- 
plication. The intersection of the exceptional sets for s in S clearly equals the 
intersection of the exceptional sets for all s in its fc-linear span. 

The structure of addition laws depends intrinsically not just on A, but also on 
the embedding i : A — > P r , determined by global sections So, . . . , s r in r(.A,Jzf), 
for the sheaf J£ — 0^(1). The hypothesis that i is a projectively normal 
embedding may be defined to be the surjectivity of the homomorphism 

OO CO 

(see Birkenhake-Lange [5] Chapter 7, Section 3] or Hartshorne [TO] Chapter I, 
Exercise 3.18 & Chapter II, Exercise 5.14]). In particular, it implies that 
{s , . . . , s r } span T(A, Jzf ). For an elliptic curve, the surjectivity of T(F r , Opr-(l)) 
on r(E,J£) is a necessary and sufficient condition for i to be projectively nor- 
mal. We recall that an invertible sheaf is said to be symmetric if J*f = [— l]*Jz? . 
Lange and Ruppert [16] determine the structure of addition laws, and in par- 
ticular prove the following main theorem. 

Theorem 1 (Lange-Ruppert) Let i : A — > P r be a projectively normal em- 
bedding of A, and Jz? = 0^(1). The sets of addition laws of bidegrees (2, 3) and 
(3, 2) on A are complete. If _§f is symmetric, then the set of addition laws of 
bidegree (2, 2) is complete, and otherwise empty. 

Remark. Lange and Ruppert assume that i is defined with respect to the 
complete linear system of an invertible sheaf _§f = ^# m where ^ is ample and 
m > 3. Their hypothesis implies the projective normality of i by a result of 
Sekiguchi [21] and the latter is sufficient for their proof. Following Sekiguchi, 
Lange and Ruppert require that k be algebraically closed, but the result relies 
only on the dimensions of sections of a certain line bungle and base-point frccncss 
of its sections, which are independent of the base field. We avoid this dependence 
by the direct assumption that t is projectively normal. 

Bosma and Lenstra give a precise description of the exceptional divisors 
of addition laws of bidegree (2,2) when A is an elliptic curve embedded as a 
Weierstrass model. Using this analysis, they prove that two addition laws are 
sufficient for a complete system. However, their description of the structure 
of addition laws applies more generally to other projective embeddings of an 
elliptic curve. We carry out this analysis to determine the dimensions of spaces 
of addition laws in families with rational torsion subgroups and study the module 
decomposition of these spaces with respect to the action of torsion. 

In view of Theorem [T] the simplest possible structure of an addition law we 
might hope for is one for which the polynomials Pj(x, y) are binomials of bidegree 



(2, 2). Such addition laws are known for Hessian models (SJ Section 4], [T3], HU, 
Jacobi quadric intersections Section 4] , and for Edwards models pQ , [9] of el- 
liptic curves. After recalling some background in Sections [2] and [31 and proving 
results about the exceptional divisors of addition laws, we introduce the concept 
of addition law projections in Section 2J In Section [5] we introduce the notion of 
a projective normal closure of an affine model of an elliptic curve in order to ap- 
ply the preceding theory. Section [6] gives a formal definition and interpretation 
of affine addition laws, expressed by rational functions, in terms of the addition 
law projections of Section 3J In Section [7] we introduce a G- module structure of 
addition laws, with respect to a rational torsion subgroup on E. In the final sec- 
tion we give examples of addition laws, observing that the simple laws coincide 
with the uniquely determined one-dimensional eigenspaces for the G-module 
structure. In the final section we analyze the G-model structure of addition 
laws for standard families - the degree 3 twisted Hessian models, the Jacobi 
quadric intersections and twisted Edwards models of degree 4 - and construct 
an analogous degree 5 model for curves with a rational 5-torsion structure. 

2 Divisors and invertible sheaves on abelian va- 
rieties 

Let A/k be an abelian variety. We denote the addition morphism by /i, the 
difference morphism by S, and let Hi : A x A — > A be the projection maps, for 
i in {1,2}. We denote by fj,*, S* , and n* the respective pullback morphisms of 
divisors and sheaves from E to E x E. 

We use the bijective correspondence between Weil divisors and Cartier di- 
visors on abelian varieties, and to such a divisor D we associate an invertible 
subsheaf Jif(D) of the sheaf Jif of total quotient rings such that for D effective, 
^f(D)^ 1 is the ideal sheaf of D (see Hartshorne [101 Chapter II, Section 6]). 
We call the invertible sheaf Jz? effective if it is isomorphic to Jif(D) for some 
effective divisor D. 

For _Sf (D) so defined, its space of global sections is the Riemann-Roch space: 

T(A,J?(D)) = {/ G k(A) : div(/) > D}, 

and an embedding A — > P r given by the complete linear system |jSf(D)| is 
determined by 

P*->(xo(P):xi{P):---:x r {P)), 

for a choice of basis {a:o, xi,..., x r } of T(A, Jzf(D)). If D is an effective Weil 
divisor we may take lo = 1, in which case we recover D as the intersection with 
the hyperplane Xq = in P r . 



2.1 Sheaves associated to the addition morphism 

Lange and Ruppert |T|] interpret an addition law of bidegree (to, n) as a homo- 
morphism of sheaves /i*Jz? — > tt^Jz?™ <g) ir^Jif™, then use the identification 

Hom(^^, 7r*^" m ® TTj^f") = T(A x A, ^.i?^ 1 (8) tt* J?™ (8) 7T*JZ*"), 

to determine their structure. In view of Theorem [TJ we will be interested in 
symmetric invertible sheaves Jz? , and the structure of sections of the sheaves 

J?m,n = M*-^ _1 (8) 7T*Jz? m (8) 7T*j2? n . 

and for the critical case of ^#2,2 we write more concisely ^ . 

We return to the study of sheaves on E x E after characterizing certain 
properties of invertible sheaves and morphisms of elliptic curves. 

2.2 Invertible sheaves on elliptic curves 

A Weierstrass model of an elliptic curve E with base point O is determined 
with respect to Jz? (3(0)) and any other cubic model in P 2 is obtained as a 
projective linear automorphism of the Weierstrass model. As a prelude to the 
study of models determined by more general symmetric divisors, we recall the 
characterization of divisors on an elliptic curve. For a divisor D on an elliptic 
curve let ev(D) be its evaluation on the curve. With this notation, the following 
lemma is immediate. 

Lemma 2 Let Jz? = Jz?(Z?) be an invertible sheaf of degree d on E. Then 
Jz? = Jz?((d — 1)(0) + (P)) where P — ev{D). Moreover Jz? is symmetric if and 
only if P is in E[2\. 

The classification of curves and their addition laws makes use of linear iso- 
morphisms between spaces of global sections of an invertible sheaf. In classifying 
curves and their addition laws, it therefore makes sense to classify elliptic curves 
up to projective linear isomorphism. 

Lemma 3 Let E\ and Ei be projectively normal embeddings of an elliptic curve 
E defined with respect to divisors D\ and £>2- Then there exists a projective 
linear isomorphism E\ — > Ei if and only if deg(Di) > deg(£>2) or D\ ~ D^. 

Proof An equivalence of divisors D\ ~ D2 implies Jz?(£>i) = Jz?(£>2), and 
the resulting linear isomorphism of global sections induces a linear isomorphism 
of the embeddings of the curve with respect to D\ and D2 (and whose inverse 
is also linear). If deg(£>i) > deg(D 2 ), we may suppose - up to equivalence - 
that D\ > £>2 > 0, and we have an inclusion of vector subspaces of k(E): 

V 2 = Y{E,^{D 2 )) CV 1 = T{E,J?{D{)) 

such that the restriction from V\ to V 2 determines the morphism E\ — > E 2 
induced by a surjective linear map on coordinate functions. Since V 2 defines the 
embedded image E 2l the restriction morphism is an isomorphism. □ 



A symmetric embedding gives rise to addition laws of minimal bidegree in 
Theorem [T] However, the structure of the negation map imposes additional 
motivation for requiring a symmetric line bundle. 

Lemma 4 If E C P r is a projectively normal embedding with respect to I£ . 
then [—1] is induced by a projective linear automorphism if and only if Jzf is 
symmetric. 

Proof If Jzf is symmetric, then [—1]* induces an automorphism of the space 
of global sections of Jzf . Conversely, since E is projectively normal in P r , a linear 
automorphism of the coordinate functions which determines [—1] also induces 
an automorphism of global sections, hence of Jzf with [— l]*Jzf . □ 

In Section[7]we analyze the G-module structure of addition laws with respect 
to a finite subgroup G = {Ti} of rational points on E. For a rational point T 
of E we denote by tt the translation-by-T map on E. The following lemma 
characterizes when tt acts linearly. 

Lemma 5 Let E C P r be a projectively normal embedding with respect to Jzf, 
and let T be in E(k). Then tt is induced by a projective linear automorphism 
if and only if [deg(Jzf)] T = 0. 

Proof It is necessary and sufficient to show that Jzf = r^Jzf . Let Jzf = Jzf (D) 
and set D' = t^D. Since deg(P') = deg(D) and ev(D') = ev(D) - [deg(L>)] T, 
by the canonical form of Lemma[2]the equivalence of the isomorphism Jzf = r^. Jzf 
holds if and only if [deg(L>)] T = O. □ 

Remark. We note that Lemma|3]and Lemma|4]refer to isomorphisms in the cat- 
egory of elliptic curves (fixing a base point), while the isomorphism of Lemma[5] 
is not an elliptic curve isomorphism. Lemma [3] is false if an isomorphism in 
the category of curves is allowed. Suppose that E\ and E 2 are embedded with 
respect to divisors D\ and D 2 and that D\ ~ t^D 2 . Then the morphism tt 
determines a linear isomorphism E\ — > E% sending O to T. 

2.3 Invert ible sheaves on E x E 

Let /i, (5, 7Ti, and tt 2 be the addition, difference, and projection morphisms, as 
above. We define 

V = {0} x E and H = E x {O} 

as divisors on E x E. Similarly, let A and V be the diagonal and anti-diagonal 
images of E in E x E, respectively. 

Lemma 6 With the above notation we have 

TTfjgf ((O)) = Sf(V), 7T 2 *Jif((0)) = J2f(JE0, 

H*^f((0)) = j5f(V), 5*_Sf((0)) = jyf(A). 
In particular if Jzf = Jzf(<i(0)), then 

fi*^" 1 ® tt* J^f m (g) 7r*J^" = .S?(-dV + dmV + dnH). 



Proof This is immediate from 

V = 7r*(0), H = tt*(0), V = n*(0) and A = 5*(0). D 

We note that each of V, H, V, and A is an elliptic curve isomorphic to 
E. In the generalization of the divisor on E from 3(0) to a more general Weil 
divisor, we obtain translates of these elementary divisors, which motivates the 
definitions 

V P := p* (P) = V + (P, 0)=V + (0,P), V P := vrj (P) = V + (P, O), 
A P := <5* (P) = A + (P, O) = A - (O, P), F P := vr 2 * (P) = H + (O, P). 

For points Q and i? in E{k) 1 let tq and t"(q,r) be the translation morphisms 
on _E and E x E. The following lemma is immediate from the definitions. 

Lemma 7 TTie translation morphism t/q r\ on E x E acts by pullback on di- 
visors by: 

t (Q,R)(&p) = &P-Q+R, t (q,r)(Vp ) = Vp-Q, 

r (*Q,i?.)( V -P) = Vp_Q_R, t (Q,R)(Hp) = Hp-R. 

2.4 Addition laws of bidegree (2,2) 

We now classify the sheaves of addition laws of bidegree (2,2). We recall the 
definition of the invertible sheaf 

Following Bosma and Lenstra |Q, we let a; be a degree 2 function on E 
with poles only at O, and observe that for x\ = x ® 1 and xi = 1 ® x in 
fc(P) ® fe fc(£7) C k(E x E), we have 

div(a;i - x 2 ) = V + A - 2V - 2H. 
This relation gives rise to the following more general systems of relations. 
Lemma 8 For points P and P in E(k) we have 

Ap_q + V P+ Q ~V + V 2P + H + H 2Q . 
If Ti and T 2 are in E[2] and T$ = T\ -\-T%, we have 

A Tl + Vp 2 - V + Vt 3 + H + H T3 ■ 

Proof The first relation is the homomorphic image of V + A ~ 2V + 2H 
under T? p( y., applying Lemma[?l then using the equivalences 2Vp ~ V+V 2 p and 
2Hp ~ H + H 2 p, which follow from the pullbacks of the sheaf isomorphisms of 
Lemma [5J The second relation follows by taking S\ and S 2 such that 2 Si — Ti, 
and specializing to (P, Q) = {—S\ + S 2l S\ + S 2 ). D 

The above lemma yields the following isomorphisms in terms of symmetric 
invertible sheaves. 



Lemma 9 Let Jz? be a symmetric invertible sheaf on E, let T\ and T<i be points 
in E[2] and set T$ = T\ + T<i. The sheaves S£i — rj. (Jz?) satisfy 

H*^! ® 5*^2 = TtJJS? <g> 7rJJ% <S> 7T2-^ ® ^2-^3, 

and to particular 

/rom w/iic/i ^ = <5*.if . 

Proof By Lemma H we have if £ j£f((d - 1)(0) + (T)) for some point T 
in E[2], and hence if 2 = Jzf(2d(0)), and similarly for the translates Jz?i. The 
lemma then follows by the equivalences of Lemma [51 extended linearly to the 
pullbacks of divisors of the form (d — 1)(0) + (T). D 

The following theorem extends the analysis of Bosma and Lenstra [6, Section 4] , 
following the lines of proof of Lange and Ruppert [TH Section 2] and [17] . 

Theorem 10 Let i : E — )■ P r be a projectively normal embedding of an elliptic 
curve, with respect to a symmetric sheaf Jz? = Jzf(-D). Then the space of global 
sections of ^# is isomorphic to the space of global sections of S£ . Moreover, the 
exceptional divisor of an addition law of bidegree (2, 2) associated to a section 
in T(E x E, JZ) is of the form Yli=i &.p t where D ~ ^(-P*). 

Proof In view of Lemma[9l and since 5 has integral fibers, we deduce that the 
difference morphism induces an isomorphism 8* : r(E,J£) -» T(E x E,5*Jf). 
The structure of the exceptional divisor follows since for D ~ J^v(i^), we have 

Since each /\p i is isomorphic to E over the algebraic closure of k, this theo- 
rem gives a simple characterization of the exceptional divisor, and of arithmetic 
completeness. 

Corollary 11 The exceptional divisor of an addition law of bidegree (2, 2) is of 
the form C = S*(D') where C n H = D' x {O}. 

Proof Each component of C is of the form Ap = S*(P) for a uniquely 
determined P, and the identity Ap n H = (P, O) extends linearly to general 
sums of divisors of the form Ap. □ 

Corollary 12 An addition law of bidegree (2, 2) with exceptional divisor C = 
S*(D') is k-complete if and only if D' has no k-rational point in its support. 

Proof A component Ap of C has a rational point (and is isomorphic to E) 
if and only if the point P lies in E(k). □ 

Remark. For addition laws of bidegree (2,2), Corollary [TT1 gives an elemen- 
tary algorithm for characterizing the exceptional divisor and Corollary [l^] for 
characterizing arithmetic completeness. 



3 Divisors and intersection theory 

For higher bidegrees, we do not expect to have an isomorphism between the 
space addition laws and the sections of an invertible sheaf on E. In order to 
determine the dimensions of these spaces, we require an explicit determination 
of the Euler-Poincare characteristic x(E x E,Sf) as a tool for determining the 
dimension of T(E X £,Jz?) = H°(E x E,Jf). 

3.1 Euler-Poincare characteristic and divisor equivalence 

For a projective variety X/k and a sheaf &, and let x(X, &) be the Euler- 
Poincare characteristic: 

oo 

X (X, 9) = £(-l)< dim fe (^(X, ^)). 

i=0 

For the classification of divisors or invertible sheaves of X, we have considered 
the linear equivalence classes in Pic(X). In order to determine the dimensions of 
spaces of addition laws, it suffices to consider the coarser algebraic equivalence 
class in the Neron-Severi group of X, defined as 

NSpf) = Pic(X)/Pic°(X). 

For a surface X, a divisor D is numerically equivalent to zero if the intersection 
product CD is zero for all curves C on X. This gives the coarsest equivalence 
relation on X and we denote the group of divisors modulo numerical equivalence 
by Numpf). We refer to Lang [T^l Chapter IV] for the general definition of 
Num(X), and the equality between Num(X) and NS(X) for abelian varieties: 

Lemma 13 If X is an abelian variety then NS(X) = Num(X). 

By the definition of numerical equivalence, the intersection product is non- 
degenerate on Num(X). In the application to X = E x E, we can determine 
the structure of NS(X). 

Lemma 14 The following diagram is exact. 



1 i 

> Pic°(E) x Pic°{E) > Pic°(E x E) > 

> Pic(.E) x Pic(E) - X * 2 > Pic(£' x E) ► End(^) > 

► NS(JS?) x NS(J5) > NS{E x E) > End(E) > 

4-- "4* >k 





Proof Exactness of the middle horizontal sequence is Exercise IV 4.10 of 
Hartshorne [10], and the vertical sequences are exact by the definition of the 
Neron-Severi group. Exactness of the upper and lower sequences follows by 
commutativity of the diagram. □ 

We note that since NS(-E) and End(_E) are free abelian groups, the lower 
sequence splits, with the splitting sending an endomorphism tp to its graph T v , 
where, in particular, rm = A and rr_ 1 i = V. Moreover, E x E is isomorphic 
to Pic°(£ x E), with isohomomorphism (P, Q) \-> V P - V + Hq - H. 

Summarizing arguments from Lange and Ruppert [17j , particularly the proof 
of Lemma 1.3, we now determine the intersection pairing on NS(25 x E). 

Lemma 15 The Neron-Severi group NS(_E x E) is a finitely generated free 
abelian group, and if End(£') = Z, it is generated by V , H , A, and V, modulo 
the relation A + V = 2V + 2H. The intersection product is nondegenerate on 
NS(E x E) and given by 
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Proof The divisors V and H are the generators of ttJ (NS (E) ) and 7r| (NS (E) ) . 
Since A and V are the graphs of [1] and [— 1], their sum induces the zero ho- 
momorphism, thus must lie in the image of 7rJ x 7rJ . The expression for A + V 
follows from the linear equivalence relation of Lemma [5J Each of V, H, A and 
V has trivial self-intersection, since they have trivial intersections with their 
translates in E x E. The identities 



V.H = V.A = V.V = H.A = H.A = 1, 

hold since each pair has a unique intersection point (O, O), and finally A.V = 4 
follows from |A n V| = \{(T,T) : T e E[2}}\ = 4. □ 

In the case of complex multiplication, the generator set can be extended 



by additional independent divisors T v 



where {1, tpi, . . . , (p r -i} is a 



basis for End(-E), by the splitting of the lower sequence of Lemma HU 

Theorem 16 Let E be an elliptic curve and Jzf be an invertible sheaf on E x E. 
The Euler-Poincare characteristic x(E x E,J£) depends only on the numerical 
equivalence class of ££ , and in particular 

X (ExE,J?(D)) = ±D.D. 

If 3e is ample, then X (E X E,&) = dim fe (r(.E x £,JSf)). 

effective and x(E x -E, Jz?) is positive, then ^£ is ample. 



Conversely, if J£ is 



Proof The first statement is the Riemann-Roch theorem for abelian surfaces 
(see Mumford [20j p. 150] or Hartshorne [TjJ| Chapter V, Theorem 1.6]). For the 
latter statements, Mumford's Vanishing Theorem [301 P- 150] states that when 
x(E x E,J?) is nonzero, H l (E x E,Jif) ^ for exactly one i = i(-£f) and that 
< i < 2. In addition, i(jSf) = i(jSf n ) for all n > [111 Corollary, p. 159]. If 
Jz? is ample it follows that i = 0, and since H°(E x E, Jz? ) = r(S x £, jSf) gives 
the only contribution to the Euler-Poincare characteristic, the result follows. In 
the other direction, for positive Euler-Poincare characteristic, clearly % ^ 1, and 
by Serre duality [TOJ Chapter III, Corollary 7.7] we have i^ 1 ) = 2 - »(jgf). 
For Jz? effective, H°{E x i?,.^ -1 ) = 0, hence i = 0. Ampleness of Jz? follows by 
Application 1 of Mumford [2UJ P- 60]. D 

The following corollary of Theorem [16] and Lemma [15] which is synthesis of 
results of Lange and Ruppert [16] [17] , allows the effective determination of the 
Euler-Poincare characteristic. 

Corollary 17 (Lange-Ruppert) Let E be an elliptic curve, then 

x(E x E, J£(x \7 + x\V + x 2 H)) — x xi + x x 2 + x\x 2 - 

In particular, if Jz? is an invertible sheaf of degree d > on E, then 

x(E x E,^ m , n ) = d [mn — m — n). 

As an application, we have a clear criterion for the sheaves ^# m] „ to be 
effective and ample. We define the product order in bidegrees by (k, I) < (m, n) 
if and only if k < m and I < n. 

Corollary 18 The sheaf ^ m ,n is ample if and only if (2,2) < (m,n). 

Proof The Euler-Poincare characteristic, x(ExE,^f min ) = d 2 (mn — m — n), 
is positive if and only if (2,2) < (m,n) by Corollary [171 and this is a nec- 
essary condition for ampleness, e.g. by the Nakai-Moishezon Criterion (see 
Hartshorne [TO] Chapter V, Theorem 1.10]). On the other hand, ^# m , n is iso- 
morphic to 

_S?(dA + d(m - 2)V + d(n - 2)H), 

hence is effective when (2, 2) < (rn, n), so ^# m ,n is ample by Theorem [TBI D 

Next we obtain a characterization of the critical case x(E X E, Jz?(Z?)) = 0. 
In view of the roles of V, A, V, and H in the divisor theory, we define T( a ,b) to 
be the image of E in E x E given by P^ (aP, bP), for a and b coprime, and 

^(na,nb) = n ^(a,b)- 



for (na,nb) set T/ nanb \ = n 2 Ti ab \. We then have equivalent expressions 



A — T( 11) , V = T( 1] _ 1 ), V = r( 0>1 ), H — r (l! o). 
Lemma 19 The divisor IV a m is numerically equivalent to 
-abV + {a 2 + ab)V + (ab + b 2 )H. 



10 



Proof The numerical equivalence class is determined by the intersection 
products 

(vr (a , 6) ,v.r (0i6) ,fr.r (0i6) ) = ((a + b) 2 .b 2 , a 2 ), 

which agrees with that of the divisor — abSI + (a 2 + ab)V + (ab + b 2 )H . □ 

Theorem 20 A divisor D on E x E satisfies \(E x E,J£(D)) = if and only 
if D is numerically equivalent to n T/ a m for integers n, a and b. 

Proof By Lemma 1151 every divisor is numerically equivalent to one of the 
form D = x V + xiV + x 2 H . By CorollarvfTTl the identity x(ExE,£?(D)) = 
defines a conic 

C : x a x\ + x x 2 + xix 2 = 

in P 2 , which has a parametrization P 1 — > C given by 

(a : b) — ► (—ab : a 2 + ab : ab + b 2 ), 

hence every triple (xq, xi,x 2 ) satisfying xoXi + xqx 2 + x\x 2 = is of the form 
n(—ab, a 2 + ab, ab + b 2 ) for integers n, a and b. By Lemma [TT)1 the divisor D is 
numerically equivalent to nTt ab \. D 

3.2 Dimensions of spaces of addition laws 

We are now in a position to relate the dimension of T(E x E, ^ m ,n) to x(E x 
E, ^ m ,n)- As a first step, we recall the statement of the Riemann-Roch theorem 
for elliptic curves. 

Theorem 21 If _Sf is an invertible sheaf of degree d > on an elliptic curve 
E, then j£f is ample and dimfc(L(_E, j£? )) = d. 

Corollary 22 Let _S? be a symmetric ample invertible sheaf of degree d on an 
elliptic curve E and 

Jt m , n = fi*^- 1 (8i TrJjSf"* <E> tt*^". 

Then for (m, n) = (2, 2), 

dim k (H°(E x E,Jt)) = &my h (E x (E x E,j#)) = d, 

and for all other m,n > 2, 

diuik(H°(E x E^M m ,ni) = d 2 (mn — m — n). 

Proof Since ^( m ,n is isomorphic to Jz?(C) for an effective divisor C, we have 
that 

H 2 (E x E,J? m , n ) ^ H°(E x J B,-# m! 1 „) = 

by Serre duality [TU1 Chapter III, Corollary 7.7], since ua — Ca for any abelian 
variety A [SJ Chapter 1, Lemma (4.2)]. The dimension of the first cohomology 
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group of ^ m ,n is then determined by the dimension of H°(E x E,M m ,n) and 
the Euler characteristic of Corollary [T7l 

For (m, n) — (2,2), the dimension of H°(E x E, ^f) is determined by The- 
orem [TU] and Theorem |2"TI and for all higher bidegrees the sheaf ^ m ,n is ample 
and x(E X E,^ m ^ n ) equals dim fc (7J°(£' x E,^ m/n )) by Theorem [TBI D 

These dimension formulas will be generalized in Section [H after the intro- 
duction of the concept of an addition law projection. 

3.3 Dimensions of sections of the ideal sheaf 

When E is embedded as a cubic curve in P 2 , the defining ideal sheaf J? E of E has 
no sections of degree 2, which is to say that dimfc(r(P 2 , ^ E (2))) = 0. However, 
a degree 4 or higher divisor always includes quadratic defining relations. This 
introduces an ambiguity in the representation of an addition law by polynomials. 
In what follows, when E is not contained in a hyperplane of P r , the ideal sheaf 
contains no linear relations, and the degree d equals r + 1, since a projective 
normal embedding is given by a complete linear system. 

Lemma 23 Let E be an elliptic curve and i : E — > P r be a projectively normal 
embedding of degree d. Then for the ideal sheaf J? E , we have 

dim k (r(P r ,J? E (n))) = ( n + r ) -nd. 

Proof Let JC = O e (1) and note that r(P r , 0{n)) -> T(E,^f n ) is surjective 
by hypothesis. Thus the dimension is determined by the number of monomials 
of degree n in r + 1 variables minus the dimension of the space T(E, j£f n ). This 
latter space has dimension nd by Riemann-Roch, from which the result follows. 
□ 

The polynomial representatives for the coordinates of an addition law of 
bidegree (m, n) are well defined only up to elements of 

I m ,n = T(P' r , J E {rn)) ® T(P r , Opr(n)) + T(¥ r , (V(m)) ® T(P r , ,y E {n)). 

Since, for d > 4, the dimension of T(P r , ^ E (2)) is nonzero, the addition laws for 
any nonplanar model have nonunique representation by polynomials. We make 
this more precise in the following corollary. 

Corollary 24 An addition law of bidegree (m, n) is represented by a coset of a 
vector space of polynomials whose dimension is 

(^"(("DCr')-*"" 

Proof The dimension of the vector space I m ,n equals 

d mn, 



m + r\ I n + r 
r ) V r 
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determined by Lemma [53] and Mobius inversion with respect to the common 
vector subspace r(P r , ./^(m)) ® r(P r , J'sin)). Since each of the r + 1 polyno- 
mials representing the addition law coordinates is a coset of the vector space 

1. □ 



4 Addition law projections 

We introduce the notion of an addition law projection first in order to define 
the concept of an affine addition law given by rational maps, expressed in terms 
of morphisms E x E M> P 1 which factor through /i. In addition we are able to 
consider generalizations of addition laws which take the form E\ x E\ — > E-2, 
where E\ and E^ are different embeddings, defined by divisors D\ and £>2- 

4.1 Definition of an addition law projection 

Let E be projectively normal in P r with if = O b (1), let <p : E -> C C P s 
be a morphism, and set if v = <^*Oc(l). We assume that if = if(-D) and 
if v = J£(D V ). We now define the space of addition law projections of bidegree 
(m,n) with respect to the composition tp o /x to be the set of (s + l)-tuples 
s = (po,...,p s ) with 

pj S T{E x £,7r*if m <g> 7r*if"), 

determining ^ o ^ on an open subvariety oi E x E. As above, we interpret 
an addition law projection s as an element of Hom(^t*if v ,7r 1 if m £3> 7r|-Sf n ), 
isomorphic to 

r(£ x E, M*^ 1 ® ttJ JST" ® TrjJJSf"). 

The principal interest is when, up to isomorphism, D > D v > 0, and tp is either 
an isomorphism or a projection to P 1 . In such a case, the morphism tp has 
a linear representation and an addition law for /i restricts to an addition law 
projection for tp o /j,. On the other hand, the space of addition laws projections 
is in general larger and may be nonzero for bidegrees less than (2, 2). 

4.2 Dimensions of spaces of addition law projections 

We are now in a position to determine the dimensions of the spaces of addition 
law projections. Let E be a projectively normal curve in P r with if = 0e(1) — 
if (D) and tp a nonconstant morphism to a curve C in P s such that 





•*£{p 


:=<p'Oc(l)*&(D v ) 


and define 








tffllf, 171,71 = 


= ^if" 1 g> 7r?if m ® 7r|if 



We assume D and D v are effective and write d — deg(D) and d v = deg(D v ). 
With this notation, we obtain the following refinement of Corollary [TT1 as a 
consequence of Lemma \T5\ and Theorem 1161 
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Corollary 25 x{^<p,m,n) = d(dmn — d v {m + nj). 

When d = 2d ip the critical bidegree is (1,1), for which the Euler-Poincare 
characteristic is zero, and when d > 2d v , the minimal bidegree of any addition 



law projection is (1,1), so we write simply 
now state a generalization of Theorem [TO] 



for the sheaf 



tip,!,!- 



We can 



Theorem 26 Let i : E — )■ P r be a projectively normal embedding of an elliptic 
curve, with respect to a symmetric sheaf Jz? = Jzf(-D), and let ip : E i— )■ P s 6e 
a nonconstant map, with respect to a symmetric sheaf Jz?^ = Jff(D v ). If both 
Jz? anrf Jz? v are symmetric and d = 2d ip , then the space of global sections of 
J& v is isomorphic to that o/ Jif® Jzf" 1 . Moreover, the exceptional divisor of an 
addition law projection of bidegree (1, 1) associated to a section in T(E x E, ^# v ) 
is of the form J2ili Ap ; where D — D v ~ $^=i(P»). 

Proof Up to equivalence of D and D v , we may assume that D, D v , and 
Z)^, are symmetric effective divisors, hence with support in E[2], such that D = 
D v + D^, and denote j£f(D^,) by JS^,. By hypothesis d = 2deg(Z) 1 / ) 
Linear extension of Lemma [3] then gives 



2d„ 



and hence 



d*D 4 ,+ f j,*D ip ^ 7: * 1 D + ^D, 



6*^ <g> /x'j^ £ TrJJS? <g> tt^JSP, 



from which <5*_S?,/, = ^#. The isomorphism of global sections and structure of 
the exceptional divisors follows as in Theorem [101 O 



Corollary 27 Let Jzf, Jzf^,, and 

(m,n) = (1,1), 



¥3,m,n ^ e as above, with d — 2d v . Then for 

if)) = O-ifii 



dim k (H°{E x E,^)) = <tim k (H l (E x £, 

awd for (m, n) > (1, 1), 

dim fe (JT°(£; x E, JZ v , m , n )) = d£((2ro - l)(2n - 1) - 1). 

Proof For (m,n) = (1,1) the dimension follows from the isomorphism of 
Theorem [26l When (m,n) > (1,1), the sheafs is effective and x(£ x £, „#) 
positive, so the equality follows from Theorem [TBI and Corollary [25l □ 
Remark. As a consequence of Corollary[25j the only possible critical cases, for 
which x(E x E, ^$, m ,n) = 0, are those in the table below, given with the value 
of h° = dim fc (r(i? x E, JKip, m ,n)), if nonzero. 



d 


d v 


(m, n) 


h° 


s(t+l) 
2d v 
d v 


st 
d v 
dp 


(M),(M) 

(i,i) 

(2,2) 


s 

d v 
d^p 
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The latter two cases are explained by Theorem [TU] and Theorem (25] By The- 
orem 1201 the exceptional divisor is numerically equivalent to a divisor of the 
form nT/ a i,y For d = 2d v and d = d v , this divisor is d v A, but for {d,d v ) = 
(s(t + l),st), the exceptional divisor is numerically equivalent to sTm t \ or 
sTi t iy Theorem 1341 of Section [5] gives an example of an elliptic curve with 
one-dimensional spaces of addition laws projections of bidegrees (1,2) and (2, 1) 
for (d,d v ) = {3,2). 

5 Affine models and projective normal closure 

A nonsingular projective curve is uniquely determined, up to unique isomor- 
phism, by an affine model C [TQl Chapter I, Corollary 6.12]. As a consequence, 
it is standard to specify a curve by an afhne model which determines it. On the 
other hand, the definition of addition laws in terms of a given affine model de- 
pends on the projections to P 1 given by the coordinate functions. In this section 
we introduce the notion of a projective normal closure of a nonsingular affine 
model C. This provides a canonical nonsingular projective model in which C 
embeds, in terms of which we define affine addition laws. In Section [6] we apply 
this definition in order to determine dimension formulas for affine addition laws. 

5.1 Projective normal closure 

Let C/k be a nonsingular affine curve in A s , with coordinate functions xi, . . . , x s 
and X its associated nonsingular projective curve. We define the divisor at 
infinity of C to be the effective divisor D — sup({div oc (xi)}), on X, where 
divoo(x) is the polar divisor of x. 

Let {xo,xi, . . . ,x r } be a generator set for T(X,JC(D)), where we assume 
xo = 1, and xi, . . . , x s are the coordinate functions on C '. Since C is nonsingular, 
its coordinate ring is integrally closed, and by the definition of D, we have 

/C|Xi,...,X s J =/C[Xi,...,X r J. 

A projectively normal closure of C is a model for X in P' r , determined by the 
morphism 

P^(x (P):x 1 (P):---:x r (P)), 

which identifies C as the open affine of X given by X — 1. Any two projectively 
normal closures are isomorphic via a linear isomorphism determined by the 
choice of generator set extending xo, . . . , x s . 

Jacobi model. The Jacobi quartic refers to the nonsingular affine curve 

y 2 = x 4 + 2ax 2 + 1, 

with base point O = (0,1), and whose standard projective closure in P 2 is 
singular. The divisor at infinity is D = 2(ooi) + 2(002), and the Riemann- 
Roch space T(E, jSf (£>)) is spanned by {1, x, y, x 2 }. Thus the projective normal 
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closure is the curve C in P 3 given by the embedding (x, y) M- (1 : x : y : x 2 ), 
with defining equations 

X 2 = X + 2aXgX3 + X^ , XqX% = X^ , 

and identity (1:0:1:0). 

The Jacobi quartic has full rational 2-torsion, which accounts for the sym- 
metries. In Section [5] we describe a canonical Jacobi model, diagonalized with 
respect to the 2-torsion subgroup, and which contains this family as a subfamily 
up to linearly isomorphism. 

Edwards model. In 2007, Edwards [5] introduced a remarkable new affine 
model for elliptic curves 

x 2 +y 2 = c 2 {l + dx 2 y 2 ). 

The parameter d, equal to 1 in Edwards' model, was introduced by Bernstein 
and Lange [T] , to obtain an fc-complete addition law for nonsquare values of d 
(and moreover the parameter c may be subsumed into d as a square factor). 
Subsequently, Bernstein et al. [5] introduced twisted Edwards curves 

ax 2 +y 2 = 1 + dx 2 y 2 . 



The divisor at infinity is D = div(a:)oo + div(y)oo, since the poles of x and y 
are disjoint. A basis for the Riemann-Roch space of D is then {1, x, y, xy}, and 
the projective normal closure in P 3 is 

Xq + dX 3 = aXi + X 2 , X0X3 = X1X2; 

with embedding {x, y) 1— > (1 : x : y : xy). This embedding in P 3 appears in Hisil 
et al. [11] , under the name extended Edwards coordinates. 

5.2 Arithmetically complete affine models 

The notion of completeness of addition laws is sometimes coupled with an inde- 
pendent condition on a particular affine model. By definition an abelian variety 
is a complete group variety - completeness is a geometric notion which is stable 
under base extension. We define an affine curve C to be k-complete or arith- 
metically complete if C{k) = X(k) for any projective nonsingular X containing 
C. For an elliptic curve, this ensures that the rational points of the affine model 
form a group. Over a sufficiently large base field, one can find a suitable line 
which misses all rational points and pass to a fc-complete affine model by a 
projective change of variables. 

In the above example of a projective normal closure for the Jacobi quartic, 
the affine patch X 2 = 1: 

1 = u + 2auw + w , uw = v , 
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is fc-complete if x 2 + 2ax + 1 is irreducible. The affine patch A3 — 1 of the 
projective normal closure of the twisted Edwards model recovers the standard 
affine representation, which is fc-complete when d is a nonsquare. An additional 
feature of the fc-complete models for twisted Edwards curves [5] or twisted Hes- 
sian curves [1] is that the line at infinity is an eigenvector for a torsion subgroup, 
which acts linearly on the affine curve. 

6 Affine addition laws 

Suppose that C is a nonsingular affine curve in A s and let E be a projective 
normal closure of C in P r . If xi,...,x s are the coordinate functions on C, 
then we denote by Xi also the projections E — > P 1 extending Xi : C — > A 1 . 
Let k[C] = k[x\, . . . ,x s ] be the coordinate ring of C, recalling that since C is 
nonsingular, k[x\, . . . ,x s ] — k[x\, . . . , X r ] — T(C, Oe), where Xi — Xi/ Xq. We 
write 

k[C] (g> k k[C] = k[xt,...,x r ,yi,---,y r ] 

where we identify Xi with Xi ® 1 and write yi for \ ® Xi, and similarly identify 
Xi with 

Xi <g> 1 e r(£ x E,ntO E (l) ® 7r5C» B (0)), 

and write Yj for 

1®I, er(£x J B,7r 1 *O B (0)®7r^C) B (l)). 

An affine addition law for C is an s-tuple of pairs (fi,gi) in [k[C] (E>k k[C]) 2 such 
that 

fi*( Xl ) = — ek(Ex E). 
9i 

We refer to {fi,gi) as an affine addition law projection for x%. We define the 

bidegree of an addition law Si — (fi,gi) to be the smallest m, and i%i such 

that Si is the restriction of an addition law projection of bidegree (rrii, rii), and 

the bidegree of s — (si,...,s s ) to be (m,n) = (max i ({m i }),max i ({rii})). We 

note that the bidegree of an addition law is determined by the minimal degree 

polynomial expression in {xi, . . . , x r , j/i, . . . , y r } for fi and gi, rather than as a 

polynomial in the coordinate functions on {xi, . . . , x s , j/i, . . . , y s }. 

Recall that the product partial order is defined by (fc, I) < (m, n) if and only if 

k < ?7i and I < n. Clearly an addition law projection of bidegree (fc, I) is also the 

restriction of an addition law projection of bidegree (to, n) when (fc, I) < (to, n), 

since the restriction map associated to C — > E is the homomorphism which 

forgets the grading: 

00 00 

k[E] = T(E, nD) — *• fc[C] = T(C, O e ) = \J T(E, nD). 

»=0 71=0 

For convenience, we say the space of addition laws (or addition law projections) 
of bidegree (m,n), to refer to the vector space of all addition laws (or addition 
law projections) of any bidegree (fc, I) < (to, n). 
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Hereafter we express an affine addition law projection (fi,Qi) as a fraction 
fi/gi and similarly write 



h h 


/, 


01 92 


& 



for an affine addition law. We note that in this context fi/gi should not be 
confused with the equivalence class z% = ft*(xi) in k(E x E), and that in this 
notation the vector space structure is written: 

fi.J'i ^ + bjj 

a — + b — = —rj- 

9i 9i ag t + bg t 

Since fi = giZi and /,' = g[zi, the equivalence class in k{E x E) remains the 
same: 



9i g'i 9i g[ a 9l + bgl 

Theorem 28 The affine addition laws for C in A s of bidegree [in, n) form a 
vector space isomorphic to the direct sum of the spaces of addition law projections 
for the coordinate functions x\, . . . ,x s of bidegree (to, n). 

Proof Every polynomial form p t in T(E x E, 7tJ0£;(to) <8> TrjOfifn)) deter- 
mines a unique function fi = pi/X^Y^ 1 in 

k[C] k[C] = T(C, O e ) r(C, Oe) 

and injectivity of pt ^ fi follows from injectivity of T(E, Ob(to)) -4 k[C\. D 

7 Torsion module structure 

Let E/k be an elliptic curve with finite torsion subgroup G C E{k). A divisor 
D is said to be G -invariant if TpD = D for all P in G, where Tp : E — > _B is the 
translation-by-P morphism. We hereafter assume that E/k is equipped with a 
projectively normal embedding in P r by ££ — Jif(D), where D is an effective 
G-invariant divisor. 

Lemma 29 Let i : E — > P r be a projectively normal embedding of E, with 
respect to Jzf . Let G be a finite torsion subgroup, and suppose that 1£ = J£{D) 
where D is an effective G-invariant divisor. Then G acts on E by projective 
linear transformations of P r . 

Proof Since D is G-invariant, the space T{E,J£) has a fc-linear repre- 
sentation by G. Since we have a surjective homomorphism r(P r , 0j»r(l)) — > 
T(E,Ji?), every linear automorphism of T(E, _£?) lifts to an automorphism of 
r(P r , Opr-(l)), hence to a projective linear transformation of P r . □ 

From the action of Tp on T(E, if), and lifting to T(P r , O r (l)), we identify 
Tp with a linear polynomial map in k[Xo, . . . , X r ] r+1 . Let G2 be the kernel of 
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the homomorphism GxGxG ->• G defined by (R, S,T) ^ R + S+T, and let d 
be the subgroup of G2 with T = 0. We define the action of G2 (hence of G\) on 
the space of addition laws of bidegree (m, n) by (R, S,T)-s = tt°So (tr x rg), 
so that 

(R, S, T) ■ s(P, Q) = s(P + R,Q + S) + T. 

Clearly G\ and G2 are isomorphic to G and G x G, respectively, with isomor- 
phisms given by R t-> (R, -R, O) and (R, S) H- (i?, S, -R-S). 

Lemma 30 TTie group G2 acts linearly on the addition laws of bidegree (m, n). 

Proof The image (R, S,T) ■ s is the composition of polynomials of bidegree 
(m, n) with linear polynomial maps, which, by the hypothesis that R + S + T = 
O, determines another addition law. □ 

Lemma 31 The group G2 acts linearly on the set of divisors of addition laws 
for E. In particular the action on the components of addition laws of bidegree 
(2,2) is given by {R,S,T)*A P = A P _ fl+5 . 

Proof The action on divisors is div((i?, S, T)-s) — (tr x Ts)*div(s), and the 
action on Ap follows from 

(tr x t s )*Ap = A + (P - R, -S) = A + (P - R+ S, O) = A P - R+S . 

Since T determines a linear automorphism of the polynomials of s, it has no 
bearing on the divisor which they cut out. □ 

Theorem 32 An addition law S is an eigenvector for an element (R, S, T) of 
G 2 if and only if the exceptional divisor of 5 is fixed by (_R, S 1 , T) . 

The abstract vector spaces of addition laws, as well as the G2-module struc- 
ture are independent of the choice of bases for T(E, J?) as well as T(E x E, ^#). 
However, the simplicity of the addition laws (as measured, for example, by their 
sparseness as polynomials) on Edwards and Hessian models, is entirely depen- 
dent on the choice of the sections in T(E,^f) and the corresponding coordinate 
functions of the projective embedding, and of the addition laws. This study 
grew out of the observation that the simplest addition laws arise from the bases 
which arise either as eigenspaces of G\ or which have a permutation represen- 
tation with respect to G± . 

For a group G acting linearly on a space of addition laws (for which we may 
consider G of the form G\ or G2 as above), we define an addition law s to be 
G-complete if {7s : 7 G G} is a geometrically complete set of addition laws 
(see @]). 

8 Addition law constructions 

In this section we apply the above analysis to determine and characterize the 
spaces of addition laws for families with rational torsion subgroups or rational 
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torsion points. In view of LemmaO we consider families with rational d-torsion 
subgroups for elliptic curve models of degree d. 

The complete spaces of addition laws of given bidegree can be determined 
for any effective addition algorithm by interpolating of points ((P, Q), fj,(P, Q)) 
with monomials of the correct bidegree. Such an approach was suggested by 
D. Bernstein and T. Lange, and a similar interpolation algorithm appears in Cas- 
tryck and Vercauteren [7]. On a generic model, for which there may exist only 
finitely many rational points, we interpolate points in the formal neighborhood 
of O or the rational torsion points. Hisil et al. [12] use an analogous approach 
through Grobner bases, based on an algorithm of Monagan and Pierce [IS], to 
systematically search for rational expressions for affinc addition laws. Using 
the automorphisms induced by torsion points, the spaces of addition laws can 
be reduced and distinguished eigenspaces computed directly. Algorithms for 
the analysis of addition laws and group actions was written in Magma |18j and 
Sage [25] . to be made available in Echidna [13] . 

For known families, particularly Edwards curves, the classification in terms 
of eigenspaces explains the canonical nature of the distinguished prescribed ad- 
dition laws reported in the literature. 

8.1 Symmetric elliptic curve models of degree 3 

Hessian model. The Hessian model H d /k : X 3 + Y 3 + Z 3 = dXYZ is well 
known as a universal model (over k(X(3))) for elliptic curves with full tor- 
sion subgroup. In Bernstein, Kohel, and Lange [3J, the twisted Hessian curves 

aX 3 + Y 3 + Z 3 = dXYZ, 

are introduced (a descent of scalars to k(Xo(3))), and their addition laws and 
completeness properties are studied. In characteristic different from 3, in terms 
of the order 3 subgroup G defined by X = 0, we can characterize the addition 
laws terms of their Gi-module structure [3] • 

Theorem 33 The space of addition laws of bidegree (2, 2) for the twisted Hes- 
sian curve is spanned by the three addition laws: 

So = (X 1 Y2Z2 — YiZiX 2 , Z-yX^Yi, — X\YiZ 2l Y 1 X 2 Z 2 — X\Z\Y 2 ), 
Si = {X{Y{Y 2 — Z x X 2 Z 2l aXiZ 1 X 2 — Y 1 Y 2 Z 2 , Y^Z\Z 2 — aX 1 X 2 Y 2 ), 
s 2 = (XiZiZ 2 — Y x X 2 Y 2 , Y 1 Z 1 Y 2 — aX 1 X 2 Z 2 , aXiY ± X 2 — Z X Y 2 Z 2 ). 

Each Si is an eigenvector for the action of G\ . 

Remark. The addition laws are also simultaneous eigenvectors for the full 
subgroup G2. Over an extension in which a is a cube root, the curve attains 
an independent 3-torsion point, which acts by scaled coordinate permutation. 
Consequently the addition laws are cyclically permuted under this action. This 
action on the addition law (4.21i) of Chudnovsky and Chudnovsky [S], in retro- 
spect, is sufficient to produce the above basis. 
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Similarly an explicit computation yields the following addition law projec- 
tions of bidegrees (1,2) and (2,1). 

Theorem 34 The twisted Hessian curve admits degree 2 coordinate projections 

(X : X - T), (Y:Y- T), and (Z : Z - T), 

where T = X + Y + Z . for which there exist addition laws of bidegree (1, 2): 

( X X Y 2 Z 2 + Y l X 2 Y 2 + Z X X 2 Z 2 : X X X\ + Y X Z\ + Z X Y 2 ), 
( X X X 2 Z 2 + Y X Y 2 Z 2 + Z X X 2 Y 2 : X X Y 2 2 + Y X X 2 + Z X Z 2 ), 
( X X X 2 Y 2 + Y X X 2 Z 2 + Z X Y 2 Z 2 : X X Z% + Z X X% + Y X Y 2 2 ), 

and of bidegree (2, 1): 



( Y X Z X X 2 + X X Y X Y 2 + X X Z X Z 2 
(X X Z X X 2 + Y X Z X Y 2 + X X Y X Z 2 
( X X Y X X 2 + X X Z X Y 2 + Y X Z X Z 2 



X 2 X 2 + Z 2 Y 2 +Y 2 Z 2 [ 
Y x X 2 + X l Y 2 + Z X Z 2 
Z x X 2 +Y ± Y 2 + X x Z 2 



Each addition laws projection spans the unique one- dimensional space of its 
bidegree. 

Remark. This provides an example of an addition law projection of the critical 
bidegree in Corollary [53 at which the Euler-Poincare characteristic is zero (see 
the remark following Corollary |27|) . Note that the projections (X : X — T) and 
{X : T) are linearly equivalent, but the former yields a simpler expression. 

8.2 Symmetric elliptic curves of degree 4 

Next we consider degree 4 models of elliptic curves, with parametrized 2-torsion 
and 4-torsion subgroups. In order to be diagonalized with respect to the torsion 
subgroup, we assume that the base field is not of characteristic 2. 

Jacobi model. Let J( a .b) be the elliptic curve over a field of characteristic 
different from 2, given by the quadric intersections in P 3 : 

aX + Xy = X 2 , 
bX + X 2 = X 3 , 

cX 2 +X 2 =Xl 

where a + b + c = 0, with identity O — (0 : 1 : 1 : 1) and 2-torsion points 

Ti = (0 : -1 : 1 : 1), T 2 = (0 : 1 : -1 : 1), T 3 = (0 : 1 : 1 : -1). 

The embedding in P 3 is given by a complete linear system associated to any 
divisor equivalent to the sum of the 2-torsion points, which in canonical form 
of Lemma [2] is 4(0). 

Theorem 35 Let E/k be an elliptic curve with projective normal embedding in 
P 3 such that O e {1) = if (4(0)). If E(k)[2] is isomorphic to (Z/2Z) 2 , then there 
exists (a, b) in k 2 such that E is linearly isomorphic to J( a ,b) ■ 
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Proof The j-invariant of the family J( a ,b) determines an S3 cover j-line by 
(a : b) in P 1 , ramified over j = and j — 12 3 , and by construction (a : b) 
represents a point on the modular curve X(2). Thus for j different from 
and 12 3 , it follows that J/ a ,b) encodes a representative elliptic curve with full 
2-torsion, and its quadratic twists, associated to each point on X(2). 

For the exceptional values j = and j = 12 3 , we first suppose that char(fc) ^ 
3, so that 7^ 12 3 (since char(fc) ^ 2 by hypothesis). An elliptic curve with 
j = or j = 12 3 is then isomorphic to y 2 — x 3 — s 3 or y 2 = a; 3 — s 2 x, respectively. 
In the former case, by hypothesis on the 2-torsion, there exists w in k such that 
uj 2 = —lu — 1, and cubic and quartic twists do not have full 2-torsion. Jacobi 
models for these curves are, respectively, 



(2lo + 1)sX 2 +X 2 =XI 




2sX 2 + X 2 -- 


- Y 2 


w(2uj + 1)sX 2 + X 2 =X 3 2 , 


and 


-sX 2 + X 2 -- 


-xl 


w 2 (2uj + l)sX 2 + X 2 =X 2 , 




sX 2 + X 2 - 


=xi 



In characteristic 3, the latter model describes all twists over k of the unique 

supersingular elliptic curve over F3 with j = 12 3 = and full 2-torsion. The 

linearity of the isomorphisms follows from Lemma [3] □ 

Example. Chudnovsky and Chudnovsky 8, Section 4] define a Jacobi quadric 

intersection 

x 2 +y 2 = 1, 

\ 2 x 2 +z 2 = l, 

which is an affine model for a curve in this family for (a, b, c) = (1, —A 2 , A 2 — 1), 
with the embedding 

(x,y,z)i — >(x:y:l: z). 

This gives an example of a nonsingular affine model, which is fc-complete over 
any field k in which —1 is not a square. 

Similarly, the projective normal closure of the Jacobi quartic (see Section [5]): 

X-2. = X + 2C1X0X3 + X 3 , Xq X3 = X 1 , 

is isomorphic to the Jacobi model with (a,b,c) — (— 2(a + l),4, 2(a— 1)), by the 
transformation (X : X 1 : X 2 : X 3 ) 1 — > (X x : X 2 : X - X 3 : X Q + X 3 ). 

Theorem 36 The space of addition laws of bidegree (2, 2) for Jr a ,b) * s spanned 
by {si : < i < 3}, where 

So = (X Y 1 — X^q , Si = (X0X2Y1Y3 + XiX 3 YqY2 7 

X0X1Y2Y3 — X2X3Y0Y1, —aXoX 3 YoY 3 + X1X2Y1Y2, 



X X 2 Y 1 Y 3 - X 1 X 3 Y Y 2 , abX 2 Y 2 + X 2 Y 2 , 



r-2 

2 > 

XqX 3 Y\Y2 — ^1^2^0^3)7 bXoXiYjYi + X2X 3 Y2Y 3 



S2 — (X0X1Y2Y3 + X2X3Y0Y1, S3 — (a(XoX 3 YiY2 + X1X2Y0Y3), 
acX 2 Y 2 + X 2 Y 2 , a(cX Q X2Y Y2 + X^Y^), 

aX Q X 3 Y Y 3 + X l X 2 Y 1 Y 2l ai-bX^Y^ + X 2 X 3 Y 2 Y 3 ) 

-cX X2Y Y 2 + X 1 X 3 Y 1 Y 3 ), -bX 2 Y 2 - cX 2 Y 2 ) 

and the exceptional divisor of Si is 5*{Dj) where Di is defined by Xj = 0. 
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Proof The dimension of the space of addition laws of bidegree (2, 2) is four 
by Corollary [22] The exceptional divisors are of the form S* (Di) by TheoremflOl 
and the divisors Di are determined by intersecting with Ji a ,b) x {O}- D 

Corollary 37 The addition laws 5$, Si, S2 and S3 are common eigenvectors for 

the translations TT t and [— 1]. 

Proof Since each of the divisors Di is fixed by Tj.. and [—1]*, the addition 
laws are immediately eigenvectors. □ 

There exists a torsion point of order 4 on Ji a ,b) if an d only if a pair {a, — c}, 
{ — a , b}, or { — b,c} consistsof squares (namely the 4-torsion points lie on X± = , 
X2 = 0, or X3 — 0, respectively). Any such point then acts linearly on the space 
r(J (Oi6) ,JSf(4(0))) by Lemma EJ 

Corollary 38 Suppose that G is a cyclic subgroup of order 4 in J( a ,b)(k)- Then 
any s in {so, Si, 82,53} is G2~complete where G2 is defined with respect to G. 

Proof The group G2 commutes with the 2-torsion subgroup, hence induces a 
permutation on the set of eigenspaces spanned by the s». In view of Lemma [3"T1 
the group G2 includes an element permuting two pairs of eigenspaces. Since 
the exceptional divisors of Theorem [3S] are pairwise disjoint, any two of the s, 
comprise a geometrically complete set. □ 

Edwards models. Let E\ = E( a ,<t) De the projective normal closure of the 
twisted Edwards model (see Section [5]) 

Xq + dXy = aXi + X2 , X0X3 = X\X2- 

In view of the role of the projective addition laws, we define its image in P 1 xP 1 : 

E 2 : aX 2 W 2 + Y 2 Z 2 = Z 2 W 2 + dX 2 Y 2 , 

given by 

(X :X 1 :X 2 : X 3 ) ^ ((X : Z), (Y : W)) = ((X : XJ, (X : X 2 )), 

which is nonsingular. It follows that the embedding in P 3 is the image of the 
Segre embedding 

((X : Z), (Y : W)) 1 — > (XY : XW : ZY : ZW) = (X : X x : X 2 : X 3 ). 

Here we describe the interplay between the embedding in P 3 and P 1 x P 1 , 
exploited in the simple addition laws of Hisil [TT] for models in P 3 , and interpret 
the addition laws and their completeness properties in terms of eigenspaces 
under the 4-torsion subgroup. The addition laws so determined on the curve E 2 
embedded in P 1 x P 1 are those studied by Bernstein and Lange [3], who prove 
their completeness properties. The above theory gives a means of explaining 
the canonical nature of these simple addition laws. 
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Suppose that c and e are square roots of a and d, respectively, in the algebraic 
closure of the base field of E 2 . Then T x = (0 : 1 : : c) and T 2 = (1 : : e : 0) 
are points of order 4, and the translation- by-Ti morphism is 

(X :X 1 :X 2 : X 3 ) .— ► {-X : c' 1 X 2 : -cX 1 : X 3 ), 
and that for translation-by-T2 is: 

(X : Xi : X 2 : X 3 ) i — > (-e~ X 3 : X\ : -X 2 : eX ). 
We note that 2T X = 2T 2 = (0 : : -1 : 1), 

T\ + T 2 = (-c : e : : 0) and 7\ - T 2 = (c : e : : 0) 

and Ei[2] = {0,2Tj,Ti ±T 2 }. Let G be the torsion subgroup (T U T 2 ), isomor- 
phic to Z/2Z x Z/4Z. We now state the characterization of the spaces of addition 
laws for the group morphism E\ x E\ — >• E 2 , in terms of bases of distinguished 
eigenvectors and their exceptional divisors. These addition laws, as well as the 
characterization of exceptional divisors, can be deduced from the addition laws 
for E 2 x E 2 — >• E 2 of Bernstein and Lange [3], by factoring through the Segre 
embedding (see note below Corollary [ 



Theorem 39 The space of addition laws for E\ x E\ — » E 2 of bidegree (1,1) 
is spanned by {(Si,ty) : < i,j < 1}, where 

So = (^o^3 + X 3 Y , aX x Y x + X 2 Y 2 ), 
si - {X X Y 2 + X 2 Y U dX Y + X 3 Y 3 ), 

with respective exceptional divisors At ± + A-Xj and At 2 + A_t 2 , and 

to = (XoY 3 — X 3 Yct, X{Y 2 — X 2 Yi), 
h = {aX 1 Y l - X 2 Y 2 , dX Q Y Q - X 3 Y 3 ), 

with respective exceptional divisors Ao + A 2 t { and Ar 1+ r 2 + At 1 -t 2 - 

Proof The correctness of the addition laws is verified by explicit substitu- 
tion. The dimension of each of the addition law projections is 2, in accordance 
with Corollary [27l and the degrees of the projections of E 2 to P 1 . Thus the 
two sets {so,Si} and {to,ti} are bases for the spaces of addition law projec- 
tions. Correctness of the exceptional divisors can be verified by intersection 
with E x {O}. □ 

Let G\ and G 2 be the subgroups defined in the previous section, with respect 
to the group G = (Ti,T 2 ). The group G\ has a well-defined action on the two 
spaces spanned by {so,Si} and {t ,ti}, while the action of G 2 only becomes 
well defined on the span of tuples {(si,ij)}. 

Corollary 40 The sets {sq,Si} and {to,ti} are stabilized by G\ and point- 
wise fixed by the subgroup ((2Tj,2Tj,0)). Moreover each of kSj and ktj are 
eigenspaces for the action of G\ . The action of G 2 stabilizes the sets of pairs 
{(fcso, fcto), (fcsi, Mi)} and {(kSo,kii), (fcsi, kio)}, and acts transitively on their 
product. 
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Proof By Theorem [321 the eigenvectors are characterized by the action on 
the exceptional divisors. By Lemma [7] and the form of the exceptional divisors 
in Theoreml3T)I we see that the exceptional divisors are stabilized by (Tj, — Tj, O) 
and hence So, Si, to and ti are eigenvectors. By explicit substitution we find 
eigenvalues (— 1, 1, — 1, 1) for T\ and eigenvalues (1, — 1, — 1, 1) for T 2 . Hence each 
of the spaces spanned by {so,Si} and {io,ti} decomposes into one-dimensional 
eigenspaces. The action on eigenspace pairs follows similarly from the action on 
exceptional divisors. □ 

Theorem 41 The addition law projection So, Si, or i\ is k-complete if and only 
if a, d, or ad is a nonsquare, respectively. In particular, over a finite field, either 
zero or two of So, Si and ti are k-complete. 

Proof The sets {T x , -Ti}, {T 2 , -T 2 } and {T x + T 2 , T x - T 2 } are Galois orbits 
of non-fc-rational points when a, d, or ad is a nonsquare, respectively, in which 
case the respective divisor A^ + A_t x , At 2 + A_^ 2 or ^■t 1 +t 2 + At 1 -t 2 , is 
irreducible over k and hence has no rational point. Over a finite field, either zero 
or two of a, d, and ad are nonsquares. □ Let ip : E 2 x E 2 — > E x be the restriction 
of the Segre embedding P 1 x P 1 — > P 3 , and identify tp with the polynomial map 

((X, Z), (Y, W)) ^ (XY, XW, ZY, ZW). 

As a consequence of the above theorem, the four-dimensional space of addition 
laws for E\ is obtained in factored form as the pairwise combination of these 
pairs of addition laws, under the Segre embedding in P 3 . 

Corollary 42 The space of addition laws of bidegree (2, 2) for 

(i : Ei x Ei — > Ei 

is spanned by {cp(si,ij) : < i,j < 1}. 

Similarly, we obtain a factored form E 2 x E 2 — >• Ei x Ei — > E 2 for the 
addition laws on E 2 . 

Corollary 43 The space of addition laws of multidegree ((1,1), (1,1)) for 

(i : E 2 x E 2 — Y E 2 

is spanned by {(st o if x <p, tj o ip x <p) : < i, j < 1}. 

In expanded form Corollary 14^1 gives the addition laws: 

<p(B , to) = ((^o^3 + X 3 Y Q )(X Y 3 - X 3 Y ), (X Y 3 + X 3 Y )(XiY 2 - Y X X 2 ), 

(aXiYi + X 2 Y 2 )(X Y 3 - X 3 Y ), {aX x Yi + X 2 Y 2 )(XiY 2 - Y X X 2 )) , 

<p(fi , ti) = ((X a Y 3 + X 3 Y )(aX x Y x - X 2 Y 2 ), (X Q Y 3 + X 3 Y ){aX x Y x - X 2 Y 2 ), 
(aXiYi + X 2 Y 2 )(dX Y Q - X 3 Y 3 ), {aX x Y x + X 2 Y 2 )(dX Y - X 3 Y 3 )), 

^(si,t ) = ((XiY 2 + X 2 Yi)(X Q Y 3 - X 3 Y ), (X X Y 2 + X 2 Y x )(XiY 2 - Y X X 2 ), 

(dX Y Q + X 3 Y 3 )(X Q Y 3 - X 3 Y ), (dX Y Q + X 3 Y 3 ){X X Y 2 - Y X X 2 )), 

¥>(si,ti) = ((XiY 2 + X 2 Yi)(aXiYi - X 2 Y 2 ), (X X Y 2 + X 2 Y x )(dX Y - X 3 Y 3 ), 
(dX Yo + X 3 Y 3 )(aXiYi - X 2 Y 2 ), (dX Q Y + X 3 Y 3 )(dX Y - X 3 Y 3 )) . 
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The forms ip(s x ,ii) and ip(so,io), with given factorization, appear as equations 
(5) and (6), respectively, in Hisil et al. [11]. Similarly, in expanded form Corol- 
lary 03] gives the addition law projections of Bernstein and Lange [3| : 

s o ip x ip = (X 1 Y 1 Z 2 W 2 + Z 1 W 1 X 2 Y 2 , aX{WiX 2 W 2 + Z X W X Z 2 W 2 ), 
Sl o<px<p= {X x W x Z 2 Y 2 + Z 1 Y 1 X 2 W 1 , dX 1 Y 1 X 2 Y 2 + Z X W X Z 2 W 2 ), 
t o p x ip = (X 1 Y 1 Z 2 W 2 - Z 1 W 1 X 2 Y 2 , X X W X Z 2 Y 2 - X 1 W 1 Z 2 Y 2 ), 
t l0 (pxip= (aX 1 W 1 X 2 W 2 - Z X Y X Z 2 Y 2 , dX x Y x X 2 Y 2 - Z 1 W 1 Z 2 W 2 ). 

The set of exceptional divisors of these addition laws, described in Bernstein and 
Lange 3, Section 8], is equivalent to that of Theorem [39l since the Segre em- 
bedding is globally defined by a single polynomial map with trivial exceptional 
divisor. 

Canonical curve of level 4. In light of the simple structure of the twisted 
Hessian curve, we define a canonical model C/k of level n to be an elliptic curve 
with subgroup scheme G = fi n , embedded in P r for r = n — 1. Moreover we 
assume that there exists T in G(k(Q), for an n-th root of unity £ in k, such 
that 

T T (X Q : Xi : ■ ■ ■ : X r ) .— ► (X : (J^ : • • • : CX r ). 

Moreover, there exists S in C(k) such that (S, T) — C[n] and for some ao, . • . , a r 
in k, 

i~s{X : Xi : ■ ■ ■ : X. r ) i — ► \a\Xi : • • • : a r X r : aoX ). 

This generalizes the Hessian model and the diagonalized Edwards model (of the 
— 1 twist). 

The Edwards curve, with a = 1, 

-^"0-^3 = X±X 2 , 
has 4-torsion point S = (1 : 1 : : 0) such that rg is: 

t~s(Xo ■ X\ : X 2 : Xg) = (X : X 2 : —X\ : —X3), 
defined by the matrix 

0-1 
1 

v -v 

which we wish to diagonalize. First we twist by a = —1 so that the diagonal- 
ization descends, and from the twisted Edwards curve, with a = — 1, 

xl - dXJ = -{X x - X 2 )(X 1 + X 2 ), X X 3 = x x x 2 , 

we find the canonical curve C of level 4'- 

X — dX 2 = X1X3, 
X x — X 3 = 4Xo^2, 
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via the isomorphism 

(Xq : X\ : X2 : X 3 ) 1 — > {X$ : X\ + X2 : X 3 : —X\ + X2). 

This curve has identity (1:1:0:1) and the point (i : 1 : : 0) on E maps to 
(1 : i : : — i) on C, which acts by 

(X :X 1 :X 2 : X 3 ) »— ► (X : iXi : -X 2 : -iX 3 ). 

Theorem 44 TTie space of addition laws of bidegree (2, 2) /or i/ie canonical 
model of level 4 is spanned by : 

so = ( -{XlYi - X$Y?)/4, 5i - ( XoXrYoYs + dX 2 X 3 Y 1 Y 2 , 
X Q X 3 Y 1 Y 2 - X 1 X 2 Y Y 3 , MX X 2 Y 2 2 + X\Y X Y 3 , 

X Y 2 — X 2 Y , XqX 3 Y 2 Y 3 + XiX 2 YqYi, 

XoXMYi - X 2 X 3 F Yi), ^1^3^ - MX$Y Y 2 ), 

5 2 = ( A 2 Y 2 - d 2 X 2 Y 2 2 , S3 = ( X X 3 Y Q Y 1 + dX X X 2 Y 2 Y 3 , 
X Q X 1 Y Y 1 - dX 2 X 3 Y 2 Y 3 , X X X 3 Y? + 4dX%Y Y 2 , 

(X 2 Y 2 - X|y 3 2 )/4, XoXiYM + X 2 X 3 Y Y 3 , 

X Q X 3 Y Y 3 - dX x X 2 Y x Y 2 ), -AdX X 2 Y 2 + X^Y^). 

8.3 Symmetric elliptic curve models of degree 5 

In analogy with the Hessian model and canonical model of level 4, we describe 
the construction of a canonical model of level 5, which we call pentagonal elliptic 
curves. As with the canonical models of levels 3 and 4, the addition laws have 
simple expressions in terms of differences of monomials. 

Pentagonal elliptic curves. We describe a model for elliptic curves over the 
function field k(t) of Xi(5). Let E/k(t) be the elliptic curve in P 4 defined by 

iUl + U 2 U 3 - U X U 4 = tUoUx + U 2 U 4 -Ul = Uf + U U 2 - U 3 U 4 = 

UiU 2 + u u 3 - ul = ul - u x u 3 + tu u 4 = 0, 

with base point O — (0:1:1:1:1). This model is derived from an input Weier- 
strass model E over k(t) by computing the Riemann-Roch space T(E,Jf(G)) 
where G = (T) is a cyclic subgroup of order 5, considered as a divisor on E. 
The coordinate functions U are determined by a choice of basis of eigenfunc- 
tions for the translation-by-T map. For a 5-th root of unity £, the image of T 
is (0 : C : C 2 : ~~ C 3 : — C 4 ) an d translation-by-T induces: 

(U a : Ux : U 2 : U 3 : U A ) 1— ► (U : C^i : ( 2 U 2 : C 3 ^ 3 : C^). 

We note that the projection to (C/ : U\ : U4) yields a plane model 

Ul + Uf-{t- 3)U 2 U 2 U Q + (2t - 1)U!U A U* - tug, 

but that being singular the dimension formulas fail to apply. Indeed there are 
no bidegree (2, 2) addition laws for this planar model. 
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Theorem 45 The space of addition laws of bidegree (2, 2) on E is of dimension 
5 and decomposes over k(t) into eigenspaces for the action ofG\. The eigenspace 
for I is given by the polynomial maps: 

( U^Vi - U^V 2 = {U x U4V 2 V 3 - U 2 U 3 V 1 V i )/t = -U 2 U 3 V 2 + U 2 V 2 V 3 : 
UoU^Vi - U2U4.V0V1 = (-U 2 U 4 V 2 + U 2 V 2 V A )/t = UoU±V 3 2 - UiVoVi : 
U U 2 V 3 V 4 - U 3 U 4 V V 2 = Uo^V? - U?V 2 V = -C/fVgVi + U 3 U A V? : 
U^J 3 V 1 V 2 - U X U 2 V Q V 3 = U U 3 V 2 - U 2 V V 3 = -U^V 2 + U 2 V 1 V 2 : 
UoU^Vs - UiU 3 V V A = U UiV 2 - U 2 V Vi = (u x u 3 vi - V 2 V x V 3 )lt). 

Remark. The function t can be identified with a modular function generating 
the function field of Xi(5). The modular curve X(5) is also of genus 0, and 
there exists a modular function e satisfying t — e 5 which generates the function 
field of X(5). Over this extension the 5-torsion point S = (1 : e : — e 2 : e 3 : 0), 
and the translation-by-iS 1 morphism is: 

(U '.UizUa'.Us: U A ) ^ {-U A : e 4 C/ : e 3 C/i : -e 2 f/ 2 : eJ7 8 ). 

The remaining eigenspaces of addition laws are permuted by the action induced 
by the subgroup G = (S). In particular, since the action is a scaled mono- 
mial permutation, the remaining eigenspaces are also described by binomial 
biquadratic polynomials. 
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